Live data from Hacker News

FBI's ability to legally access secure messaging app content and metadata [pdf]

propertyofthepeople.org

81–90 of 474 posts

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#81
post #18

Earlier quoted context omitted.

Has Apple made any public statements regarding iCloud's lack of privacy features. It takes the wind out of their privacy marketing that is effectively hurting ad tech but not truly protecting consumers from state-level actors with data access.

Kind of. These details are indeed publicly written on their website[0]. Do many users ever read this page? Probably not. [0] https://support.apple.com/en-us/HT202303

Here is an excerpt. The language sounds like encryption is enabled and the chart includes iCloud features as server and in transit protected. Seems like smoke and mirrors then.

> On each of your devices, the data that you store in iCloud and that's associated with your Apple ID is protected with a key derived from information unique to that device, combined with your device passcode which only you know. No one else, not even Apple, can access end-to-end encrypted information.

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#82
post #6

It says Telegram has no message content. Isn't telegram not E2EE by default, instead required explicit steps to make a conversation encrypted? Either way looks like Signal wins by a lot. The size of it spot is so small, it seems almost squeezed in. But only because they have nothing to share.

Telegram is encrypted OVER THE WIRE and AT REST by default with strong encryption no matter what you do. It's E2EE if you select private chat with someone.

Lots of FUD out there there about Telegram not being encrypted that's just not true. There's nothing either side can to do send a message in clear text / unencrypted.

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#83

They left off one very popular messenger, SMS: * Message content: All * Subpoena: can render all message content for the last 1-7 years * 18 U.S.C 2703(d): can render all message content for the last 1-7 years * Search warrant: can render all message content for the last 1-7 years * Vague suspicion plus a small fee to the carrier: can render all message content for the last 1-7 years

There's also: * Law enforcement simply asks nicely: can render all message content for the last 1-7 years

* Law enforcement wants to stalk ex-girlfriend: can render all message content for the last 1-7 years

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#84

Earlier quoted context omitted.

> the FBI's ability to legally access secure content Maybe there are laws preventing legal access to message content? Maybe related to wherever Telegram is incorporated.

It helps Telegram is HQ'd in the UK and the operational center is in Dubai.

Does it? UK and Dubai are USA partners in Intelligence gathering and work together several times.

Biggest example as of late: https://www.bbc.com/news/world-middle-east-58558690

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#85
post #6

It says Telegram has no message content. Isn't telegram not E2EE by default, instead required explicit steps to make a conversation encrypted? Either way looks like Signal wins by a lot. The size of it spot is so small, it seems almost squeezed in. But only because they have nothing to share.

> the FBI's ability to legally access secure content Maybe there are laws preventing legal access to message content? Maybe related to wherever Telegram is incorporated.

> Maybe there are laws preventing legal access to message content?

Well sure. A lot of laws require a court order. In the U.S. that's usually not too difficult.

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#86
post #13
post #6

It says Telegram has no message content. Isn't telegram not E2EE by default, instead required explicit steps to make a conversation encrypted? Either way looks like Signal wins by a lot. The size of it spot is so small, it seems almost squeezed in. But only because they have nothing to share.

That is correct. By default all messages sent over Telegram are stored permanently in their servers unencrypted.

Source for Telegram storing the information unencrypted at rest?

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#87
post #38

Earlier quoted context omitted.

for signal users this means the messages of course do exist on your phone, which will be the first thing these agencies seek to abscond with once youre detained as its infinitely more crackable in their hands. as a casual reminder: The fifth amendment protects your speech, not your biometrics. do not use face or fingerprint to secure your phone. use a strong passphrase, and if in doubt, power down the phone (android)…

> do not use face or fingerprint to secure your phone but can't they force you to put your password in that case, instead of your finger?

How? They can physically overpower you and place the sensor against your finger, or in front of your eye and pry it open without your consent and gain access with 0 input from you. How do they similarly force you to type something that requires deliberate, repeated concrete actions on your part?

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#88
post #82
post #6

It says Telegram has no message content. Isn't telegram not E2EE by default, instead required explicit steps to make a conversation encrypted? Either way looks like Signal wins by a lot. The size of it spot is so small, it seems almost squeezed in. But only because they have nothing to share.

Telegram is encrypted OVER THE WIRE and AT REST by default with strong encryption no matter what you do. It's E2EE if you select private chat with someone. Lots of FUD out there there about Telegram not being encrypted that's just not true. There's nothing either side can to do send a message in clear text / unencrypted.

For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee? Does the former mean that telegram itself can read non-private-chat messages if it so chooses?

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#89
post #38

Earlier quoted context omitted.

for signal users this means the messages of course do exist on your phone, which will be the first thing these agencies seek to abscond with once youre detained as its infinitely more crackable in their hands. as a casual reminder: The fifth amendment protects your speech, not your biometrics. do not use face or fingerprint to secure your phone. use a strong passphrase, and if in doubt, power down the phone (android)…

My advice if you’re not on the level where three letter agencies are actively interested in your comings and goings: - Use a strong pass phrase - Enable biometrics so you don’t need to type that pass phrase 100 times per day - Learn the shortcut to have your phone disable biometrics and require the pass phrase so you can use it when police is coming for you, you’re entering the immigration line in the airport etc. -…

I just tried this an it does not work for iPhone is it only on a certain iOS? I am a bit behind on updates. Thanks

Re: FBI's ability to legally access secure messaging app content and metadata [pdf]

#90

Isn’t this simply imaginary, where in practice all the FBI has to do to up the ante is to request military-grade interception from a willing foreign counterpart?

The point of promoting and using privacy respecting software is not necessarily to make it impossible for law enforcement to get what they want. It's to make it somewhat expensive and require targeted probes. You simply want it to be cost prohibitive to engage in mass surveillance on everyone, because that is an immensely powerful tool of totalitarian oppression that get really bad if we happen to elect the wrong per…

I don't care if they spy on me; they probably have a good reason to! But I do care if they spy on everyone, so I make it hard to spy on me.
Post reply on HN